Repository navigation
--severity, --category, --domain and --status filters (risks and controls) accept any text and a typo returns an empty list #53
Description
Measured
crates/hodeishield-cli/src/cli.rs:164,196,225,228,260: those filters areString.- In the contract they are
stringwith noenum(openapi/v1.json:/v1/alerts→severity,/v1/vendors→category,/v1/risks→domainandstatus,/v1/compliance/controls→status). The filters that do have anenumin the contract are already validated in the CLI.
Why it matters
Any user: --severity High instead of high returns empty without any warning, and it looks like there is no data.
Acceptance criteria
- The accepted values are validated in the CLI and appear in
--help. - An unknown value exits with code 2 and lists the options.
Depends on
A change in the public /v1 API: declare an enum for those parameters.
Activity
d0ubl3g commentedon Oct 12, 2026
Done in 0.4.0 (https://github.com/Hodeitek/hodeishield-cli/releases/tag/v0.4.0), by #138 (and the earlier #93, #95, #97), on main at 3405f04. The CLI now follows version 2026-10-16 of the
API document. The alerts
--severityfilter lists its values in--help(critical,high,medium,low,info) and warns onstandard error about a value the API does not list, with a hint when only the case differs. For the deprecated values (
critico,alto,medio,bajo, accepted until 2027-01-14) it names the replacement. On the second criterion: the API document declaresthese filters as open vocabularies (known values, not an
enum), so an unlisted value may still be valid. The CLI therefore warnsand sends it as typed, instead of refusing it with exit code 2.
category,domainand the risk and controlstatusfiltershave no published list yet; they will be checked the same way as soon as the document lists their values.